What you describe sounds like a macro. https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Usesearchmacros ... View more

Yes, this is a potential issue with using CSV files for lookups (one I've been bitten by myself and had to spend quite some time before discovering what the problem was), race conditions can occur when multiple users want to lock the same file for writing. It is one good reason to use KV store based lookups instead. A comparison between CSV based and KV store based lookups is available on this page: http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/DefineaKVStorelookupinSplunkWeb#KV_Store_vs._CSV_files ... View more

limit is used for limiting how many columns the chart command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5 , that means Splunk will limit the field2 columns to 5. It doesn't take effect when splitting by only one field. Also even if the limit argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results. ... View more

I would write a subsearch for retrieving all a_rid values for events with the "Instance errored" message, then either run transaction or stats for getting the desired results. I noticed you say you're searching for "Microservice" but the example event you show doesn't actually have that string in it - maybe you meant sourcetype=Microservice or something? I'm assuming this in my query below. index=nameofindex [search index=nameofindex sourcetype=Microservice "Instance errored" | fields a_rid] | transaction a_rid | search a_tid=00001 ...or similarly using stats , which is cheaper from a performance perspective: index=nameofindex [search index=nameofindex sourcetype=Microservice "Instance errored" | fields a_rid] | stats values(a_tid) as a_tid by a_rid | search a_tid=00001 ... View more

stats is a consuming command - it will only output what you've specifically told it to output. All the rest of the stuff that it receives as input is gone after it. So when you run stats max(my*) by _time , the only fields that will be available after that are _time (because you're splitting by it) and all the my* fields (because you're running max() on them). If you want to perform the stats calculations but not consume all other input, use eventstats instead. It will do the same thing but instead just write its results to the specified fields and leave the rest of the available data as-is. ... View more

I think you may have misunderstood how the CIDR matching on lookups works. First of all inputlookup is just a way to read stuff from a lookup file and make the fields in that file available to the rest of the search pipeline. The where argument only provides basic filtering capabilities. The CIDR match applies when using the lookup command (or if the lookup is performed implicitly). You'd match it against specified data from a search pipeline, and Splunk would compare the IP address provided in the data to the CIDR ranges defined in the lookup to see if the IP belongs to any of them. If you don't have any data to match against but just want to specify an IP that is matched using CIDR, you could do something like | makeresults | eval ip=10.10.10.10 | lookup network_ranges Range as ip OUTPUT Info | table ip Info ... View more

You probably want bucket for grouping your events by time and deduping on that. ... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time ... View more